v0.1.5: parallelize gnomad_get_variant batch lookups under the concurrency cap

parallelize gnomad_get_variant batch lookups under the concurrency cap

Batch variant lookups fan out concurrently instead of a serial loop; the existing GNOMAD_MAX_CONCURRENCY semaphore still bounds upstream GraphQL calls.

Changed:

• gnomad_get_variant — batch dispatch is now concurrent (was a serial for loop), bounded by the existing GnomadService semaphore (GNOMAD_MAX_CONCURRENCY, default 2); per-item partial success preserved and found[]/failed[] stay in input order. No schema change. (#10)

107 tests pass; bun run devcheck clean.

v0.1.4: region coverage bounds, ClinVar ENSG guidance, js-yaml DoS cleared

region coverage bounds, ClinVar ENSG guidance, js-yaml DoS cleared

Two fixes plus a security-bearing framework bump.

Fixed:

• gnomad_get_coverage: region coverage bounded to the requested start..stop span; gnomAD's 151 bp padded window no longer leaks ±75 bp of neighboring bases into the summary (single-position region → one bin). Gene/transcript coverage unchanged. (#8)
• gnomad_search_clinvar: an Ensembl gene ID (ENSG…) returns a targeted notice pointing to ensembl_lookup_gene and short-circuits before the NCBI query, instead of a bare empty result; the gene input description carries the HGNC-only constraint. (#9)

Changed:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10

Security:

• Transitive js-yaml (via the depcheck dev dependency) resolved to 3.15.0, clearing GHSA-h67p-54hq-rp68 / CVE-2026-53550 — a quadratic-complexity DoS in YAML merge-key handling via repeated aliases. bun audit: one moderate advisory → zero.

105 tests pass; bun run devcheck clean.

v0.1.3: Region-ordering guard, configurable variant batch cap, exact-position triage coverage

Region-ordering guard, configurable variant batch cap, exact-position triage coverage

Fixed:

• gnomad_get_coverage / gnomad_list_gene_variants — an inverted region (start > stop) is rejected immediately as a ValidationError (reason: invalid_region, non-retryable) before any upstream call, instead of burning the retry budget on gnomAD's HTTP 500 and surfacing a misleading "unavailable" error; a single position (start == stop) stays valid (#1)
• gnomad_get_variant — GNOMAD_MAX_VARIANT_BATCH now drives the batch cap (was hard-coded 25): the configured value flows into the advertised variants.maxItems, parse-time validation, and the description prose (#4)
• gnomad_variant_triage — the callability step confirms the exact variant position (single-position region from a chrom-pos-ref-alt, or the resolved variant_id for an rsID) instead of gene-level coverage; dataset values are quoted in every tool-call example (#6)

99 tests pass; bun run devcheck clean.

v0.1.2: Correctness fixes for the ClinVar significance filter, dual-callset frequency rows, and the LOEUF interval render

Correctness fixes for the ClinVar significance filter, dual-callset frequency rows, and the LOEUF interval render

Fixed:

• gnomad_search_clinvar — clinical_significance enforced post-fetch; the NCBI field tag leaked non-matching classifications, and the whole-word match now composes with min_review_stars (#2)
• gnomad_list_gene_variants — exome|genome rows report joint AN (sum across callsets) and joint AF (recomputed from ac/an); max_af filters the joint frequency (#3)
• gnomad_get_gene_constraint — content[] LOEUF interval upper bound renders oe_lof_upper, not the oe_lof point estimate (#5)

94 tests pass; bun run devcheck clean.

v0.1.1: @cyanheads npm scope and launch metadata

@cyanheads npm scope and launch metadata

First release carrying the complete gnomAD surface — variant allele frequencies by ancestry, gene loss-of-function constraint, gene variant lists, sequencing coverage, and gene-level ClinVar, with a DataCanvas SQL path. Per-tool detail is in the 0.1.0 changelog.

Changed:

• Scoped the package to @cyanheads/gnomad-genetics-mcp-server — install args, npm/Cursor/VS Code badges, plugin manifests, and both server.json package identifiers
• Aligned the one-line description across package.json, server.json, manifest.json, the plugin manifests, and the Docker OCI label
• Completed package.json metadata (mcpName, bugs, homepage, author, funding, packageManager) and manifest.json (repository, homepage, license)
• Dropped the redundant websiteUrl from createApp()

Dependency bumps:

• @types/node ^26.0.0 → ^26.0.1

88 tests pass; bun run devcheck clean.